AI in marketing: truthfulness, data and publication conditions

Laura, a marketer, gets a banner to review: an illustrated entrepreneur labelled "Character created by AI", with the quote "My revenue doubled" next to them. No customer ever had that result; the team invented both the person and the testimonial. The label said where the picture came from, but the false evidence stayed in place.

Material like this raises several questions at once: where the data came from, whether the claims are supported, on what terms the likeness and voice were used, and which requirements apply to distribution. The client needs a process that answers each of them before publication and helps fix mistakes afterwards. A new model or a more detailed prompt will not replace that process.

Describe the use and a possible error

"We use AI in marketing" is too broad to assess. In one process the system edits a public article, in another it receives a customer extract, in a third it voices a person. Each of the three has its own sources, recipients and checks.

For each process, write down the input material, the vendor, the connections, where the output will be used and who owns it. Then name the error the review has to catch. For the banner it is an unsupported testimonial, for a product photo a part that is not in the box, for an analysis disclosed customer data or a wrong calculation.

Describe risk as a scenario plus the check that catches it, rather than a percentage pulled out of thin air. If the model can attribute a result to a customer, the editor needs proof of the figure and the authority to send the material back until it arrives. If generation alters the product, compare the final image with what is actually in the box.

An invented story can be shown as an example, but not as a customer testimonial: the audience will read it as fact. A testimonial implies that the person exists and their result is confirmed.

Examine doubled revenue using source data

There is no real data behind the banner, so the testimonial goes. But to see what a real case would need, take a separate calculation with illustrative numbers. In the first period, 20 orders with an average value of 20,000 ₸ brought in 400,000 ₸. In the second, the same 20 orders averaging 40,000 ₸ brought in 800,000 ₸.

Revenue rose by 800,000 - 400,000 = 400,000 ₸, or 400,000 / 400,000 = 100%. There were no more orders; the average order value grew. Why it grew, these numbers cannot tell you: prices, order composition or other conditions may have changed. One comparison is not enough to credit all the growth to the advertised tool.

A verified case puts the source, period and limits of the conclusion next to the calculation. Ours is an arithmetic example and does not support the banner's testimonial. You can use it to explain how growth is calculated, as long as it is labelled as such. Evidence from a real customer takes a different set of material.

A synthetic product photo gets equally strict scrutiny. If generation added a function or changed a material, a generation label does not fix the mismatch with the offer. Correct the content first and deal with sources and disclosure afterwards.

Separate a legal interpretation from a launch decision

The Law of the Republic of Kazakhstan "On Artificial Intelligence" (No. 230-VIII of 17.11.2025, as amended up to 25.08.2026) allows synthetic output to be distributed only with machine-readable labelling and a visible or otherwise perceivable warning (Art. 21(2)). The duty to inform users lies with owners and holders of AI systems (Art. 21(3)); the law does not say whether it covers a business publishing an image from someone else's service. The procedure for developing, applying and distributing machine-readable forms is approved by the authorised body (Art. 22(3)). AI-assisted output is protected by copyright only where a human made a creative contribution (Art. 23(1)). This is not legal advice: a lawyer makes the call on the campaign.

A visible warning and a machine-readable form are implemented in different ways. The advice "just add alt text" leaves both questions open. Once you choose an approach, check the result in the final file and in the placement: export or the platform itself can change what the user sees.

Another country needs its own review of which laws apply there. If the brief only lists laws, nothing has been checked against them yet. The working record keeps the source, the edition, open questions and the person who made the decision.

Trace data to the final recipient

For practice, synthetic enquiries without customer details are enough. In a live workflow, first decide which fields are needed and in what environment they may be handled, and only then transfer the extract. For example, grouping reasons for refusal may not need a person's contact details at all.

Removing the name and phone number discloses less, but links to other data can still sometimes identify the person. So look at everything together: what is in the record, who has access to it and where it goes. Replacing a contact with a code is not the whole review of the process.

With an AI vendor, distinguish four things: whether it uses the material for training, how it stores it, which staff can access it and whether it passes it to connected services. A promise on one point says nothing about the others. The data owner records which sources, fields and operations are allowed and how temporary copies are deleted.

For material with a likeness or voice, keep its source and the agreed scope of use. Permission for an internal recording and a plan for external advertising are two different questions. Send the purpose, channels, duration, changes and context for review together with the final file. If an AI service processes data abroad, uploading personal data to it, such as a photo of a face, is in our reading best treated as a cross-border transfer. The Law "On Personal Data and Their Protection" (as amended up to 14.09.2026) requires consent for it in Art. 7(6), except in the cases listed in Art. 16, and the consent must name such a transfer (Art. 8(4)(5)).

Make decisions reproducible

Every asset has a person who makes the substantive decision; in our example it is Laura. The record keeps the version, the factual sources and the placement. If the promise or conditions change, the material goes back for review: approval of an agent action covers the exact text version and publication parameters.

NIST AI RMF is a voluntary framework for handling AI risks. It helps a team connect error scenarios, checks and owners. Whether a campaign is permissible still depends on its conditions and the applicable requirements.

If a false promise turns up after launch, the first thing is to take it down from every placement. The owner finds all copies and versions, keeps a record of the error and works out who it affected. Then, together with the relevant specialists, they arrange the correction and decide who needs to be notified and how.

Editing the prompt only affects future editions; copies already published are removed separately, on each platform. After the review, the team changes the check that let the error through: for example, the editor no longer accepts a customer figure without a source.

Exercise: prepare a corrected banner

The team believes the "created by AI" label settled every question. Write down what needs to change in the ad itself, what material the review will need and who approves the result. Then take one generated output from your own project and trace it from the input source to publication.

The invented testimonial is the first thing to leave the banner. In its place goes an explanatory example with a clear label, or a real case once the data has been reconciled. Next comes the source of the likeness, the labelling questions that apply and how everything looks in the final format. The corrected version goes for approval, and the old one is taken out of every active placement.

The doubling calculation shows why a substantive review matters even when the arithmetic is right. A bigger total and a proven product effect answer different questions. Keep that boundary in your own project: what is known, what supports it and which decision remains open.